UNCLASSIFIED IT Security Certification Assessor POSITION DESCRIPTION Unit, Directorate: Location: IT & Physical Security, Protective Security Wellington Salary range: H $77,711 - $116,567 Purpose of position: The purpose of this position is to assess systems against government standards to ensure compliance and operability. This position will also be seen as the certification subject matter expert offering advice and guidance to a range of individuals / teams. Our mission at the NZSIS is to keep New Zealand and New Zealanders safe and secure Our values are Collaborative, Courageous, Positive, Driven and Self-aware Protective Security purpose: The Protective Security (PS) Directorate delivers a full range of protective security functions to the New Zealand Intelligence Community (NZIC) and for New Zealand. Our focus is also on leveraging the strong foundations that we have established to enhance our recognition as a NZIC protective security exemplar and to assists key New Zealand institutions to mitigate their insider threat risks through effective security clearance management, vetting services and counter intelligence functions. The PS Directorate also leads the implementation of the Protective Security Requirements (PSR) programme, which aims to substantially improve the security culture of the public service and, potentially, the private sector. UNCLASSIFIED
Key accountabilities Deliverables/Outcomes Assess IT systems for certification Assess compliance of systems for system security Assess test plans and test results for system security Complete inspection and audit of systems Production of a final report comprising findings of the assessment and recommendations to the Certification Authority Maintain records on the management and status of system certifications Promotes the certification practice in the NZIC Systems are thoroughly assessed for compliance in accordance with standards, legislation and regulations. System owners furnish fulsome test methodologies including the process for testing systems to ensure they are secure and results attest to this outcome. System inspections and audits are completed via a paper based review of certification artefacts and/or a hands-on interaction with the system functionality provided by a Subject Matter Expert. Recommendations to the Certification Authority are to the expected standard and meet requirements. Reviews and recommendations are made in a timely manner as agreed with management / stakeholders. All records on the management and status of system certifications are complete, correct and easily accessible. Is recognised as the subject matter expert in system certification. Ensures certification artefacts (templates) are up to date and accurately reflect standards (such as the PSR and ISM). Provides accurate and timely certification advice and guidance to ITSAs as they work collaboratively with system owners/project teams. Provides timely and relevant education on certification requirements, including delivery of training and educational materials. Risk management All activities take account of security, operational and organisation reputational risk and these risks are managed to approved standards and escalated to management where appropriate. All activities are consistent with NZSIS legally mandated role and functions. Any residual risks in systems are identified and highlighted.
Health and safety (for self) Work safely and take responsibility for keeping self and colleagues free from harm Report all incidents and hazards promptly Know what to do in the event of an emergency Cooperate in implementing return to work plans Be a visible role model at all times Follow NZSIS s safety rules and procedures Other duties A safe and healthy workplace for all people using our sites as a place of work All requirements in the NZIC Health and Safety policy and procedures are met Any other duties that fall within the scope of the position Position delegation Financial delegation: None Key stakeholders Internal: Directorate staff and contractors NZSIS system owners and their representatives/associates (system administrators, system engineers, testers etc.) NZIC Certification Authorities NZIC Chief Information Security Officers NZIC Chief Security Officers NZIC IT Security Managers NZIC COMSOs External: GCSB system owners GCSB Accreditation team members Counterparts within the wider New Zealand Intelligence Community and central government agencies, including Police, NZDF, Customs, MFAT, MPI and MBIE Other partner intelligence agencies and law enforcement organisations Other relevant public or private sector organisations as required
Person Specification Experience: Knowledge and Skills: Qualifications and Courses: At least five years experience in large scale and complex IT systems design, implementation and maintenance. Experience in conducting IT security assessments, audits and applying security risk management practices. Experience in the intelligence sector Proven knowledge and application of: o AS/NZS ISO 31000:2009 Risk Management principles and guidelines. o ISO/IEC 27006:2011 Information Technology Security Techniques Requirements for bodies providing audit and certification of information security management systems. o ISO/IEC 27007:2011 Information Technology Security Techniques Guidelines for information security management systems auditing Proven understanding of protective security principles and practices, including familiarity with Protective Security Requirements and the New Zealand Information Security Manual. Holistic understanding and exposure to certification and accreditation frameworks in an Intelligence Community context. A high level of accuracy and attention to detail. Professional customer focus with a strong commitment to providing a high standard of customer service. Information Systems or Computer Science degree, or Information Assurance and Security (Level 7) Graduate Diploma ISACA Certified Information Systems Auditor or Security Manager (CISA/CISM) or GIAC Security s (GSEC), or equivalent experience IT security qualification such as System Security Certified Practitioner (SSCP) Other industry recognised certification such as:
Specific Job Requirements: o o Information Technology Infrastructure Library (ITIL) The Open Group Architecture Framework (TOGAF) Demonstrated high levels of integrity and an ability to maintain a TSS security clearance. Well developed interpersonal skills with the ability to engage with a diverse range of people at all levels of the organisation. Ability to work independently using sound judgement and initiative. Proven ability to work as a member of a successful team at all levels of the organisation. Strong analytical skills with the ability to work methodically and display an aptitude for problem solving. Excellent written and oral communication skills, with an ability to convey technical information in a manner that is understood by the audience. Self motivated with excellent planning and organisational skills, and the ability to prioritise tasks to meet deadlines and effectively manage changing priorities. Proven coaching and mentoring skills and ability. Changes to Position Description Positions in the NZSIS may change over time as the organisation develops. Therefore we are committed to maintaining a flexible organisation structure that best enables us to meet changing market and customer needs. Responsibilities for this position may change over time as the job evolves. This Position Description may be reviewed as part of planning for the annual performance cycle. Date PD reviewed: 16/01/2019 Signatures Manager s Name Signature Date: Employee s Name Signature Date: